Urgent SAP NetWeaver Java Patches: Don’t Let Ransomware In Through CVE-2025-31324 and CVE-2025-42999

Sara Kim breaks down what you need to know

When I see CVEs with “remote code execution” and “actively exploited by ransomware groups” in the same sentence, I stop whatever tool I’m building and pay attention. You should too. The two flaws in SAP NetWeaver Java – CVE-2025-31324 and CVE-2025-42999 – aren’t theoretical. Attackers are already using them to drop ransomware on SAP landscapes, and the window to respond is closing fast. This isn’t a typical patch cycle; it’s an emergency for anyone running NetWeaver Java.

The Real Story

CVE-2025-31324 is a remote code execution (RCE) vulnerability in the Java stack. The root cause sits in how certain services handle serialized objects, allowing an unauthenticated attacker to inject arbitrary code simply by sending a crafted HTTP request. Once they’re in, they can escalate privileges, install backdoors, and pivot to your SAP database – no valid user required. CVE-2025-42999 is an improper access control flaw that lets attackers sidestep authentication checks entirely in specific configurations, granting unauthorized access to sensitive administrative interfaces.

Both have been observed in active ransomware campaigns. Threat groups are chaining these two CVEs: the access control weakness gets them a foothold, and the RCE delivers their payload. For an SAP developer or Basis admin, that means your carefully tuned transport landscape and code quality gates become irrelevant the moment a single unpatched instance is compromised.

The SAP Security Notes for these issues have been available, but too many organizations are still lagging. The usual excuses – “it’s a development system,” “we’ll patch next maintenance window” – now carry an unacceptable risk.

What This Means for You

If you’re a developer, understand that the NetWeaver Java stack often underpins custom web dynpro apps, portal components, or integration endpoints you’ve built. A compromised AS Java can leak your source code, change runtime behavior, or act as a launchpad into the ABAP stack via JCo connections. Even your unit tests running on a vulnerable CI server can become the entry vector.

For Basis and architects, the challenge is visibility. Many large landscapes have dozens of Java instances, some forgotten after a merger or a failed project. Inventory is the first hurdle. You must also consider that attackers target non-production systems deliberately – they’re usually less monitored and contain similar data due to sandbox refreshes.

A practical nightmare scenario: your SAP PO (Process Orchestration) instance runs on NetWeaver Java and is exposed to the internet for partner integration. Both CVEs could let an attacker hijack the adapter engine, then pivot to your ERP. I’ve seen teams fumble this because they never applied SAP note 3537311 (CVE-2025-31324) to the PI system, thinking it wasn’t “business-critical.”

Action Items

Time is not on your side, so here’s your triage checklist:

• Apply the SAP Note for CVE-2025-31324 immediately. No exceptions. For most systems this is a single restart, but verify it landed correctly using SAP’s note verification tool or a manual check of the Java runtime version. If you can’t patch now, isolate the instance from the network – but don’t wait.
• Patch CVE-2025-42999 right after. This note may involve updating the user management engine (UME) components. Test in a sandbox first, but speed matters more than perfection right now.
• Audit every NetWeaver Java instance – including dev, test, training, and sandbox – for indicators of compromise. Look for new admin users in UME, suspicious .jsp files in the webdynpro directory, unexpected open ports, or anomalous HTTP requests in the access logs (e.g., POSTs to /startup/ with serialized Java objects).
• Verify your patch levels across the landscape. I often see teams patching production but forgetting the standby DR node. Use SAP Solution Manager’s system recommendations, or a simple PowerShell script that queries the system information URL to build a dashboard. Automate this inventory – it pays for itself.
• Integrate SAP-specific threat intelligence feeds. Feed service alerts from SAP Security, Onapsis, or your own CERT into your monitoring tools. These groups often release IoCs (IPs, file hashes) linked to known ransomware TTPs targeting these CVEs. Set up alerts so that a new CVE exploited in the wild triggers a PagerDuty notification, not a monthly report.

Community Perspective

Developers in the SAP community are already sharing their war stories. One Basis architect I spoke with discovered that their third-party vendor’s system was compromised via CVE-2025-31324 and had been pushing malicious transports into their QA landscape for weeks – all because they neglected threat intelligence integration. Another team found that their automated build pipeline, running on a NetWeaver Java CI tool, had become patient zero for a ransomware deployment. The lesson? Your toolchain itself is part of the attack surface. Code quality isn’t just about static analysis results; it’s about the integrity of every system that touches your code.

There’s also a healthy debate about whether SAP should provide ready-made YARA rules or AMSI signatures for these exploits. While we wait, we’re sharing detection scripts on forums like the SAP Community Network. One useful approach: grep your access logs for serialized Java objects longer than a few hundred bytes hitting unauthenticated endpoints. That’s a quick, dirty, and surprisingly effective indicator of CVE-2025-31324 exploit attempts.

Bottom Line

Patching these vulnerabilities isn’t a “nice-to-have” or something to schedule for next month’s change

References

• SAP Notes and Patches Archives
• SAP Security Notes & News
• SAP Community Hub

References

• SAP Community Hub
• SAP Notes and Patches Archives
• SAP Security Notes & News